88 breaches, 2.15 billion records, and 41 leaks that nobody can reset

The rate is the part the report leaves on the table. Thirty-seven of the 88 incidents fall inside the 32 months from January 2024 to August 2026 ^[7]. Treat the timeline as starting in January 2011 and the other 51 spread across roughly 156 months, which is about one incident a quarter in the older period against better than one a month in the recent one, a rate around three and a half times higher ^[18]. Some of that gap is an artefact of counting: a 2013 exposure is harder to find than a 2025 one. The rest is supply. Mandates create databases, and databases are what leave.

The concentration is the more useful detail for anyone buying this as a service. AU10TIX, which verifies identity for TikTok, Uber and X, left admin credentials exposed for more than a year ^[10]. Sumsub disclosed a support-system intrusion that ran undetected for 18 months ^[11]. Persona, which handles age verification for Discord and Roblox, exposed its own frontend configuration ^[12]. The report's claim is that every major vendor of this era appears somewhere in the timeline, naming AU10TIX, IDMerit, Sumsub, Persona and inVOID ^[1]. Outsourcing an age gate does not take the ID off your risk register. It moves the document into a company whose client list is the reason to attack it, and whose incidents you will hear about second.

Discord's case shows where the harm lands. The roughly 70,000 government IDs exposed through a third-party support provider belonged to users who had challenged an age-verification decision, meaning people who were trying to correct the system's judgement about them, and Discord carried on expanding age checks afterwards ^[9]. Tea, built as a women-only safety platform, lost verification selfies out of an open storage bucket, and the images later showed up on 4chan ^[8].

Government registries are in the same list at larger scale. Argentina's national identity system leaked 45 million records including ID scans and selfies ^[13], and France's ANTS, the agency that issues French identity documents, confirmed 11.7 million people affected in a 2026 breach ^[14]. Those two alone account for about 56.7 million ^[20], with India's Aadhaar, Thailand's visitor database, the Philippines' voter rolls and Brazil's tax registry also on the timeline ^[15].

Two cautions on the headline number. The compiler is a VPN company, Mysterium, which is worth holding in mind while reading its framing even though the incidents are individually checkable ^[3]. And the 4.54 billion attributed to attacker and seller claims is more than twice the verified figure ^[19], so the number to argue about is 2.15 billion ^[4]. The number to budget against is 41: the incidents where ID scans, verification selfies, fingerprints and biometric templates were part of what leaked, none of which can be reissued ^[6]. SecurityAffairs' reading is that leaning on a reputable third-party provider is not sufficient protection for firms weighing build against outsource ^[16], and the report's own conclusion is that this is one failure mode repeated across fifteen years and every type of organisation that decided to collect this category of data ^[2].